July 18, 2017 By Mark Samuels 2 min read

New attacks against unfinished installations of WordPress aim to give attackers admin access and the opportunity to run PHP code.

The campaign, which was revealed by security specialist Wordfence, peaked during May and June when attackers targeted recently installed, but not configured, instances WordPress, SecurityWeek reported. Outsiders can use a successful attack to take over the new WordPress website and then potentially gain access to the entire hosting account.

Accessing WordPress Sites

According to the SecurityWeek article, many WordPress users install the platform by either unzipping the archive into a directory on their hosting account or by using a one-click installer from a hosting provider. But the process remains incomplete until a user creates a configuration file, and those who fail to complete installation leave themselves open to attack. In a blog post for Wordfence, chief executive Mark Maunder said his firm noticed that these high-level attackers started targeting unfinished WordPress installations.

Attackers scan for the setup URL and identify new instances of WordPress in which a user has uploaded the WordPress content management system but not completed the configuration. Such sites are open to outside connections, making it possible for external parties to access and complete the installation on the user’s behalf.

Malicious actors who discover an unfinished install can click through language selection and an introductory message before entering their own database-server information. WordPress then confirms that it can communicate with the database, allowing the outsider to complete installation, create an admin account and sign in to WordPress on the victim’s server.

The Dangers of PHP Code Execution

An attacker with admin access to a WordPress website can execute any PHP code and can undertake a range of malicious activities. Wordfence said a common action is to install a malicious shell in a hosting account. Such errant activity allows an attacker to access all files, websites and even databases on a WordPress account.

Wordfence suggested that there are several ways to complete this task, such as launching a theme and inserting PHP code, or creating and uploading a custom plug-in.

If news of the PHP code threat is not bad enough, a Wordfence report warned that the number of daily complex attacks against WordPress rose to 7.2 million in June 2017, up 32 percent from May. The average number of daily brute-force attacks increased by 36 percent month to month, with a peak level at more than 41 million.

Responding Effectively

Security experts suggested that incomplete WordPress installations remain a threat. One simple mitigation step is to complete configuration during the installation process. In his blog post for Wordfence, Maunder suggested that website admins could scan their hosting accounts for incomplete installations. Monitoring and auditing can also provide a further level of protection, he said.

Site owners should take note of the ever-growing threat from both unfinished WordPress installations and PHP code violations. They should work to fill potential security holes by completing configuration exercises, and by drawing on monitoring and auditing best practices.

More from

How prepared are you for your first Gen AI disruption?

5 min read - Generative artificial intelligence (Gen AI) and its use by businesses to enhance operations and profits are the focus of innovation in virtually every sector and industry. Gartner predicts that global spending on AI software will surge from $124 billion in 2022 to $297 billion by 2027. Businesses are upskilling their teams and hiring costly experts to implement new use cases, new ways to leverage data and new ways to use open-source tooling and resources. What they have failed to look…

Cybersecurity crisis communication: What to do

4 min read - Cybersecurity experts tell organizations that the question is not if they will become the target of a cyberattack but when. Often, the focus of response preparedness is on the technical aspects — how to stop the breach from continuing, recovering data and getting the business back online. While these tasks are critical, many organizations overlook a key part of response preparedness: crisis communication.Because a brand’s reputation often takes a significant hit, a cyberattack can significantly affect the company’s future success…

Brands are changing cybersecurity strategies due to AI threats

3 min read -  Over the past 18 months, AI has changed how we do many things in our work and professional lives — from helping us write emails to affecting how we approach cybersecurity. A recent Voice of SecOps 2024 study found that AI was a huge reason for many shifts in cybersecurity over the past 12 months. Interestingly, AI was both the cause of new issues as well as quickly becoming a common solution for those very same challenges.The study was conducted…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today